{"id":"CVE-2023-34121","state":"PUBLISHED","title":"Improper input validation  in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting  clients before 5.14.0  may allow an authenticated user to potentially enable an escalation","description":"Improper input validation  in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting  clients before 5.14.0  may allow an authenticated user to potentially enable an escalation of privilege  via network access.","publishedAt":"2023-06-13T17:42:17.823Z","updatedAt":"2025-01-02T20:00:09.588Z","severity":{"score":4.1,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","source":"Zoom"},"assigner":"Zoom","products":["Zoom Video Communications, Inc. Zoom for Windows","Zoom Video Communications, Inc. Zoom Rooms Client for Windows","ZoomZoom Video Communications, Inc. Zoom VDI for Windows Meeting Clients"],"affected":[{"vendor":"Zoom Video Communications, Inc.","product":"Zoom for Windows","defaultStatus":"unaffected","versions":[{"version":"before 5.14.0","status":"affected"}]},{"vendor":"Zoom Video Communications, Inc.","product":"Zoom Rooms Client for Windows","defaultStatus":"unaffected","versions":[{"version":"before 5.14.0","status":"affected"}]},{"vendor":"ZoomZoom Video Communications, Inc.","product":"Zoom VDI for Windows Meeting Clients","defaultStatus":"unaffected","versions":[{"version":"before 5.14.0","status":"affected"}]}],"references":["https://explore.zoom.us/en/trust/security/security-bulletin/"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:06:00.499Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/34xxx/CVE-2023-34121.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-34121","state":"PUBLISHED","datePublished":"2023-06-13T17:42:17.823Z","dateUpdated":"2025-01-02T20:00:09.588Z","assignerShortName":"Zoom","assignerOrgId":"99b9af0d-a833-4a5d-9e2f-8b1324f35351","dateReserved":"2023-05-25T22:01:29.098Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Improper input validation  in the Zoom for Windows, Zoom Rooms, Zoom VDI Windows Meeting  clients before 5.14.0  may allow an authenticated user to potentially enable an escalation of privilege  via network access."}],"affected":[{"vendor":"Zoom Video Communications, Inc.","product":"Zoom for Windows","defaultStatus":"unaffected","versions":[{"version":"before 5.14.0","status":"affected"}]},{"vendor":"Zoom Video Communications, Inc.","product":"Zoom Rooms Client for Windows","defaultStatus":"unaffected","versions":[{"version":"before 5.14.0","status":"affected"}]},{"vendor":"ZoomZoom Video Communications, Inc.","product":"Zoom VDI for Windows Meeting Clients","defaultStatus":"unaffected","versions":[{"version":"before 5.14.0","status":"affected"}]}],"references":[{"url":"https://explore.zoom.us/en/trust/security/security-bulletin/"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Zoom","orgId":"99b9af0d-a833-4a5d-9e2f-8b1324f35351","dateUpdated":"2024-09-19T19:34:39.015Z"},"datePublic":"2023-06-13T16:00:00.000Z","impacts":[{"capecId":"CAPEC-153","descriptions":[{"lang":"en","value":"CAPEC-153: Input Data Manipulation"}]}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://explore.zoom.us/en/trust/security/security-bulletin/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T16:01:53.417Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-02T19:59:23.228944Z","id":"CVE-2023-34121","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-02T20:00:09.588Z"}}]}}}